sjat
db1e5db138
Two bugs caught by the live make check/deploy on askari:
- include_tasks with a tag selects the include but NOT its tasks, so --tags hardening
ran nothing. Use apply: {tags:} to propagate (also fixed the firewall include).
- fail2ban service start + restart handler fail in a first-run --check (package not
installed yet); guard both with when: not ansible_check_mode so check is clean.
Applied to askari: SSH hardened, fail2ban active, ping still works (no lockout).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
662 B
YAML
24 lines
662 B
YAML
---
|
|
# `apply: tags:` propagates the concern tag to the INCLUDED tasks — without it a tag on
|
|
# a dynamic include_tasks only selects the include itself, not its contents, so
|
|
# `--tags <concern>` would run nothing (Ansible gotcha).
|
|
- name: Configure host firewall (nftables)
|
|
ansible.builtin.include_tasks:
|
|
file: firewall.yml
|
|
apply:
|
|
tags: [firewall]
|
|
tags: [firewall]
|
|
|
|
- name: SSH hardening
|
|
ansible.builtin.include_tasks:
|
|
file: ssh.yml
|
|
apply:
|
|
tags: [hardening]
|
|
tags: [hardening]
|
|
|
|
- name: Fail2ban intrusion deterrence
|
|
ansible.builtin.include_tasks:
|
|
file: fail2ban.yml
|
|
apply:
|
|
tags: [hardening]
|
|
tags: [hardening]
|